Model fabricated a user turn mid-response and acted on it (wrote files)

What happened

In a long session (one /compact had occurred), the assistant finished answering my
message, then — within the same assistant turn, with no user input in between — emitted
text that rendered as a user message, then responded to it and performed file writes
based on it.

Evidence from the session transcript (.jsonl)

Walking parentUuid backwards from the tool_use record that started the file writes:

[tool_use]                 <- assistant
"<short assistant text>"   <- assistant (text)
(thinking block)           <- assistant
<previous answer>          <- assistant
<my actual message>        <- user, promptSource: "typed", origin: {kind: "human"}

The fabricated message appears nowhere as a user record. All 72 real prompts in the
session carry promptSource: "typed".

Impact

The assistant created a new file and edited another based on an instruction I never gave.
Read-only would have been harmless; this performed writes.

Suspected cause (guess)

The fabricated turn's content closely matched a request I had made much earlier in the
conversation, which was present in the /compact summary. It looks like summarized
history was re-materialized as a fresh user turn.

Environment

• Claude Code CLI, background session (sessionKind: bg)
• Model: claude-opus-5[1m]
• macOS (Darwin 24.6.0)